1d47cd3f713612b8de7c89e8aae0a367d8b2ee850f73f6d7031ff74d50d45aaa

Analysis

max time kernel
0s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/12/2023, 01:12

Target

1f921bfe6ea42affbbd69e4ceb9a6848.exe
Size

209KB
MD5

1f921bfe6ea42affbbd69e4ceb9a6848
SHA1

3c8090374c41e59436eee0dea5f6262da82f2ac3
SHA256

1d47cd3f713612b8de7c89e8aae0a367d8b2ee850f73f6d7031ff74d50d45aaa
SHA512

2580c987bae14439f79ce2bd43d26d21d97ad7094bcf85f4fb4885fff95bbc64e84892b83d28a68cbbf719e2d2fd6f1803354b0144b3e3fde34233835243f6b1
SSDEEP

3072:Gl/Oe4en/0bnjprqPZt/7OviOqUt0vYknjtoEQcida3ib5xCBzNH5y:GlH400npmniixAwoEMw3wcNZy

Score

7^/10

Executes dropped EXE 2 IoCs

pid	Process
3276	u.dll
1568	mpress.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 828	1108	1f921bfe6ea42affbbd69e4ceb9a6848.exe	24
PID 1108 wrote to memory of 828	1108	1f921bfe6ea42affbbd69e4ceb9a6848.exe	24
PID 1108 wrote to memory of 828	1108	1f921bfe6ea42affbbd69e4ceb9a6848.exe	24
PID 828 wrote to memory of 3276	828	cmd.exe	22
PID 828 wrote to memory of 3276	828	cmd.exe	22
PID 828 wrote to memory of 3276	828	cmd.exe	22
PID 3276 wrote to memory of 1568	3276	u.dll	21
PID 3276 wrote to memory of 1568	3276	u.dll	21
PID 3276 wrote to memory of 1568	3276	u.dll	21
PID 828 wrote to memory of 3184	828	cmd.exe	17
PID 828 wrote to memory of 3184	828	cmd.exe	17
PID 828 wrote to memory of 3184	828	cmd.exe	17

C:\Users\Admin\AppData\Local\Temp\1f921bfe6ea42affbbd69e4ceb9a6848.exe
"C:\Users\Admin\AppData\Local\Temp\1f921bfe6ea42affbbd69e4ceb9a6848.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\3E61.tmp\vir.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3464

C:\Users\Admin\AppData\Local\Temp\3EAF.tmp\mpress.exe
"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp\mpress.exe" "C:\Users\Admin\AppData\Local\Temp\exe3EB0.tmp"
1⤵
- Executes dropped EXE
PID:1568

C:\Users\Admin\AppData\Local\Temp\3E61.tmp\vir.bat

Filesize
1KB

MD5
45c1be47a0a104832ca305c8c4a353d3

SHA1
8af0d273f99d3d1db84661eb60565516a3a2b00f

SHA256
312f39c09658543bd65423d621c5cc611d8000e3b832f36ae88d2d364049f664

SHA512
63517963547fdd035841965eb80f113764a591ced2a64d1b4e0691b038df6cbdf9512fc45488cefef288ce8c933d26fa53776b8c84db926e77e5fd6bf0f99af9

Download Submit
memory/1108-0-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1108-1-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1108-71-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download
memory/1568-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1568-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download